Is CVE-2026-126735 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126735 being exploited in the wild.

How severe is CVE-2026-126735?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Drupal Campaign Monitor before 3.0.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Campaignmonitor ECOSYSTEM:introduced=0,fixed=3.0.3.

How is CVE-2026-126735 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126735?

Check whether you run Drupal Campaign Monitor or Packagist:Https://Packages.Drupal.Org/8 Drupal/Campaignmonitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126735: Drupal Campaign Monitor module cross-site request forgery

CVE-2026-126735 · Severity: info · Published 2026-11-11

The Campaign Monitor module for Drupal integrates email subscription management into Drupal websites. A cross-site request forgery (CSRF) vulnerability in the module's admin routes allows an attacker to perform unauthorized actions on Campaign Monitor lists if an administrator clicks a malicious link. The attack requires both the specific list ID and an admin user interaction, limiting the practical risk.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126735 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126735 being exploited in the wild.
How severe is CVE-2026-126735?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Drupal Campaign Monitor before 3.0.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Campaignmonitor ECOSYSTEM:introduced=0,fixed=3.0.3.
Is there a fix for CVE-2026-126735?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Campaignmonitor: upgrade to 3.0.3 or later. Until then: Restrict access to the 'administer campaignmonitor' permission to trusted administrators only, and educate users not to click untrusted links on Drupal sites. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126735 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126735?: Check whether you run Drupal Campaign Monitor or Packagist:Https://Packages.Drupal.Org/8 Drupal/Campaignmonitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Campaignmonitor: upgrade to 3.0.3 or later

Restrict access to the 'administer campaignmonitor' permission to trusted administrators only, and educate users not to click untrusted links on Drupal sites.

Technical details

The module lacks sufficient CSRF protection on its administrative routes, allowing attackers to craft malicious requests that execute actions on Campaign Monitor lists. Exploitation requires an attacker to know the exact Campaign Monitor list ID and trick a user with 'administer campaignmonitor' permission into clicking an embedded link. A fix is available in version 3.0.3.

Affected products

Drupal Campaign Monitor before 3.0.3

Identifiers

CVE-2026-126735
DRUPAL-CONTRIB-2026-326

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.